Changeset 172494 in webkit

Timestamp:

Aug 12, 2014 2:31:23 PM (10 years ago)

Author:

Antti Koivisto

Message:

Don't recurse into non-rendered subtrees when computing style
​https://bugs.webkit.org/show_bug.cgi?id=135844

Reviewed by Andreas Kling.
Source/WebCore:

• style/StyleResolveTree.cpp:

(WebCore::Style::resetStyleForNonRenderedDescendants):

Do a simple reset of the style dirty bits and any computed style in non-rendered subtrees.

(WebCore::Style::attachRenderTree):
(WebCore::Style::resolveTree):

Don't recurse into descendants if the element does not create a renderer.
We didn't compute style anyway in such subtrees.

LayoutTests:

Rebase.

• http/tests/security/video-poster-cross-origin-crash-expected.txt:
• platform/mac/fast/ruby/ruby-base-merge-block-children-crash-2-expected.txt:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/video-poster-cross-origin-crash-expected.txt (modified) (1 diff)
• LayoutTests/platform/mac/fast/ruby/ruby-base-merge-block-children-crash-2-expected.txt (modified) (3 diffs)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/style/StyleResolveTree.cpp (modified) (6 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-08-12  Antti Koivisto  <antti@apple.com>
+
+        Don't recurse into non-rendered subtrees when computing style
+        https://bugs.webkit.org/show_bug.cgi?id=135844
+
+        Reviewed by Andreas Kling.
+        
+        Rebase.
+
+        * http/tests/security/video-poster-cross-origin-crash-expected.txt:
+        * platform/mac/fast/ruby/ruby-base-merge-block-children-crash-2-expected.txt:
+
 2014-08-12  Fabien Vallée  <fvallee@connected-labs.com>
 

trunk/LayoutTests/http/tests/security/video-poster-cross-origin-crash-expected.txt

@@ -1 @@
-CONSOLE MESSAGE: Cross-origin image load denied by Cross-Origin Resource Sharing policy.
 CONSOLE MESSAGE: Cross-origin image load denied by Cross-Origin Resource Sharing policy.
 >>>

trunk/LayoutTests/platform/mac/fast/ruby/ruby-base-merge-block-children-crash-2-expected.txt

@@ -5 +5 @@
     RenderBody {BODY} at (8,8) size 784x584
       RenderBlock {SUMMARY} at (0,0) size 784x184
-        RenderInline {I} at (0,0) size 304x18
+        RenderInline {I} at (0,0) size 604x18
           RenderRuby (inline) {RUBY} at (0,0) size 300x18
             RenderRubyRun (anonymous) at (0,171) size 0x0
@@ -21 +21 @@
           RenderText {#text} at (300,157) size 4x18
             text run at (300,157) width 4: " "
-        RenderEmbeddedObject {OBJECT} at (304,21) size 300x150
+          RenderEmbeddedObject {OBJECT} at (304,21) size 300x150
         RenderText {#text} at (0,0) size 0x0
       RenderBlock {DIV} at (0,184) size 784x18
@@ -30 +30 @@
           text run at (138,0) width 455: ". This test must be run under Guard Malloc. It passes if it does not crash."
 selection start: position 0 of child 1 {OBJECT} of child 3 {H1} of child 0 {RUBY} of child 1 {I} of child 0 {SUMMARY} of body
-selection end:   position 0 of child 3 {#text} of child 0 {SUMMARY} of body
+selection end:   position 1 of child 2 {OBJECT} of child 1 {I} of child 0 {SUMMARY} of body

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-08-12  Antti Koivisto  <antti@apple.com>
+
+        Don't recurse into non-rendered subtrees when computing style
+        https://bugs.webkit.org/show_bug.cgi?id=135844
+
+        Reviewed by Andreas Kling.
+
+        * style/StyleResolveTree.cpp:
+        (WebCore::Style::resetStyleForNonRenderedDescendants):
+        
+        Do a simple reset of the style dirty bits and any computed style in non-rendered subtrees.
+
+        (WebCore::Style::attachRenderTree):
+        (WebCore::Style::resolveTree):
+        
+        Don't recurse into descendants if the element does not create a renderer.
+        We didn't compute style anyway in such subtrees.
+
 2014-08-12  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/style/StyleResolveTree.cpp

@@ -556 +556 @@
 }
 
+static void resetStyleForNonRenderedDescendants(Element& current)
+{
+    ASSERT(!current.renderStyle());
+    auto descendants = descendantsOfType<Element>(current);
+    auto it = descendants.begin();
+    auto end = descendants.end();
+    while (it != end) {
+        auto& element = *it;
+        ASSERT(!element.renderStyle());
+        if (element.needsStyleRecalc()) {
+            element.resetComputedStyle();
+            element.clearNeedsStyleRecalc();
+        }
+        if (element.childNeedsStyleRecalc()) {
+            element.clearChildNeedsStyleRecalc();
+            it.traverseNext();
+        } else
+            it.traverseNextSkippingChildren();
+    }
+}
+
 static bool needsPseudoElement(Element& current, PseudoId pseudoId)
 {
@@ -583 +604 @@
     WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
 
+    if (isInsertionPoint(current)) {
+        attachDistributedChildren(toInsertionPoint(current), inheritedStyle, renderTreePosition);
+        return;
+    }
+
     if (current.hasCustomStyleResolveCallbacks())
         current.willAttachRenderers();
@@ -588 +614 @@
     createRendererIfNeeded(current, inheritedStyle, renderTreePosition, resolvedStyle);
 
-    StyleResolverParentPusher parentPusher(&current);
-
-    RenderTreePosition childRenderTreePosition(current.renderer());
-    attachBeforeOrAfterPseudoElementIfNeeded(current, BEFORE, childRenderTreePosition);
-
-    if (ShadowRoot* shadowRoot = current.shadowRoot()) {
-        parentPusher.push();
-        attachShadowRoot(*shadowRoot);
-    } else if (current.firstChild())
-        parentPusher.push();
-
-    if (isInsertionPoint(current))
-        attachDistributedChildren(toInsertionPoint(current), inheritedStyle, renderTreePosition);
-    else
-        attachChildren(current, current.renderStyle(), childRenderTreePosition);
+    if (RenderStyle* style = current.renderStyle()) {
+        StyleResolverParentPusher parentPusher(&current);
+
+        RenderTreePosition childRenderTreePosition(current.renderer());
+        attachBeforeOrAfterPseudoElementIfNeeded(current, BEFORE, childRenderTreePosition);
+
+        if (ShadowRoot* shadowRoot = current.shadowRoot()) {
+            parentPusher.push();
+            attachShadowRoot(*shadowRoot);
+        } else if (current.firstChild())
+            parentPusher.push();
+
+        attachChildren(current, style, childRenderTreePosition);
+
+        if (AXObjectCache* cache = current.document().axObjectCache())
+            cache->updateCacheAfterNodeIsAttached(&current);
+
+        attachBeforeOrAfterPseudoElementIfNeeded(current, AFTER, childRenderTreePosition);
+
+        current.updateFocusAppearanceAfterAttachIfNeeded();
+    } else
+        resetStyleForNonRenderedDescendants(current);
 
     current.clearNeedsStyleRecalc();
     current.clearChildNeedsStyleRecalc();
-
-    if (AXObjectCache* cache = current.document().axObjectCache())
-        cache->updateCacheAfterNodeIsAttached(&current);
-
-    attachBeforeOrAfterPseudoElementIfNeeded(current, AFTER, childRenderTreePosition);
-
-    current.updateFocusAppearanceAfterAttachIfNeeded();
 
     if (current.hasCustomStyleResolveCallbacks())
@@ -885 +911 @@
         change = resolveLocal(current, inheritedStyle, renderTreePosition, change);
 
-    if (change != Detach) {
+    RenderStyle* style = current.renderStyle();
+
+    if (change != Detach && style) {
         StyleResolverParentPusher parentPusher(&current);
 
@@ -918 +946 @@
             if (change >= Inherit || childElement->childNeedsStyleRecalc() || childElement->needsStyleRecalc()) {
                 parentPusher.push();
-                resolveTree(*childElement, current.renderStyle(), childRenderTreePosition, change);
+                resolveTree(*childElement, style, childRenderTreePosition, change);
             }
             forceCheckOfNextElementSibling = childRulesChanged && hasDirectAdjacentRules;
@@ -926 +954 @@
         updateBeforeOrAfterPseudoElement(current, change, AFTER, childRenderTreePosition);
     }
+    if (change != Detach && !style)
+        resetStyleForNonRenderedDescendants(current);
 
     current.clearNeedsStyleRecalc();